coder · ibetitsmike · Aug 12, 2025 · Aug 19, 2025 · Aug 19, 2025 · Aug 20, 2025
diff --git a/agent/agent.go b/agent/agent.go
@@ -70,6 +70,16 @@ const (
 	EnvProcOOMScore = "CODER_PROC_OOM_SCORE"
 )
 
+// agentImmortalDialer wraps the standard dialer for immortal streams.
+// Agent services are available on both tailnet and localhost interfaces.
+type agentImmortalDialer struct {
+	standardDialer *net.Dialer
+}
+
+func (d *agentImmortalDialer) DialContext(ctx context.Context, network, address string) (net.Conn, error) {
+	return d.standardDialer.DialContext(ctx, network, address)
+}
+
 type Options struct {
 	Filesystem                   afero.Fs
 	LogDir                       string
@@ -352,7 +362,10 @@ func (a *agent) init() {
 	a.containerAPI = agentcontainers.NewAPI(a.logger.Named("containers"), containerAPIOpts...)
 
 	// Initialize immortal streams manager
-	a.immortalStreamsManager = immortalstreams.New(a.logger.Named("immortal-streams"), &net.Dialer{})
+	immortalDialer := &agentImmortalDialer{
+		standardDialer: &net.Dialer{},
+	}
+	a.immortalStreamsManager = immortalstreams.New(a.logger.Named("immortal-streams"), immortalDialer)
 
 	a.reconnectingPTYServer = reconnectingpty.NewServer(
 		a.logger.Named("reconnecting-pty"),
@@ -1485,6 +1498,7 @@ func (a *agent) createTailnet(
 	}
 
 	for _, port := range []int{workspacesdk.AgentSSHPort, workspacesdk.AgentStandardSSHPort} {
+		// Listen on tailnet interface for external connections
 		sshListener, err := network.Listen("tcp", ":"+strconv.Itoa(port))
 		if err != nil {
 			return nil, xerrors.Errorf("listen on the ssh port (%v): %w", port, err)
@@ -1500,6 +1514,25 @@ func (a *agent) createTailnet(
 		}); err != nil {
 			return nil, err
 		}
+
+		// Also listen on localhost for immortal streams (only for SSH port 1)
+		if port == workspacesdk.AgentSSHPort {
+			localhostListener, err := net.Listen("tcp", "127.0.0.1:"+strconv.Itoa(port))
+			if err != nil {
+				return nil, xerrors.Errorf("listen on localhost ssh port (%v): %w", port, err)
+			}
+			// nolint:revive // We do want to run the deferred functions when createTailnet returns.
+			defer func() {
+				if err != nil {
+					_ = localhostListener.Close()
+				}
+			}()
+			if err = a.trackGoroutine(func() {
+				_ = a.sshServer.Serve(localhostListener)
+			}); err != nil {
+				return nil, err
+			}
+		}
 	}
 
 	reconnectingPTYListener, err := network.Listen("tcp", ":"+strconv.Itoa(workspacesdk.AgentReconnectingPTYPort))
@@ -1570,6 +1603,7 @@ func (a *agent) createTailnet(
 		return nil, err
 	}
 
+	// Listen on tailnet interface for external connections
 	apiListener, err := network.Listen("tcp", ":"+strconv.Itoa(workspacesdk.AgentHTTPAPIServerPort))
 	if err != nil {
 		return nil, xerrors.Errorf("api listener: %w", err)
@@ -1606,6 +1640,43 @@ func (a *agent) createTailnet(
 		return nil, err
 	}
 
+	// Also listen on localhost for immortal streams WebSocket connections
+	localhostAPIListener, err := net.Listen("tcp", "127.0.0.1:"+strconv.Itoa(workspacesdk.AgentHTTPAPIServerPort))
+	if err != nil {
+		return nil, xerrors.Errorf("localhost api listener: %w", err)
+	}
+	defer func() {
+		if err != nil {
+			_ = localhostAPIListener.Close()
+		}
+	}()
+	if err = a.trackGoroutine(func() {
+		defer localhostAPIListener.Close()
+		apiHandler := a.apiHandler()
+		server := &http.Server{
+			BaseContext:       func(net.Listener) context.Context { return ctx },
+			Handler:           apiHandler,
+			ReadTimeout:       20 * time.Second,
+			ReadHeaderTimeout: 20 * time.Second,
+			WriteTimeout:      20 * time.Second,
+			ErrorLog:          slog.Stdlib(ctx, a.logger.Named("http_api_server_localhost"), slog.LevelInfo),
+		}
+		go func() {
+			select {
+			case <-ctx.Done():
+			case <-a.hardCtx.Done():
+			}
+			_ = server.Close()
+		}()
+
+		apiServErr := server.Serve(localhostAPIListener)
+		if apiServErr != nil && !xerrors.Is(apiServErr, http.ErrServerClosed) && !strings.Contains(apiServErr.Error(), "use of closed network connection") {
+			a.logger.Critical(ctx, "serve localhost HTTP API server", slog.Error(apiServErr))
+		}
+	}); err != nil {
+		return nil, err
+	}
+
 	return network, nil
 }
 

diff --git a/cli/exp.go b/cli/exp.go
@@ -16,6 +16,7 @@ func (r *RootCmd) expCmd() *serpent.Command {
 			r.mcpCommand(),
 			r.promptExample(),
 			r.rptyCommand(),
+			r.immortalStreamCmd(),
 		},
 	}
 	return cmd

diff --git a/cli/immortalstreams.go b/cli/immortalstreams.go
@@ -0,0 +1,188 @@
+package cli
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/google/uuid"
+	"golang.org/x/xerrors"
+
+	"cdr.dev/slog"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/serpent"
+)
+
+// immortalStreamClient provides methods to interact with immortal streams API
+// This uses the main codersdk.Client to make server-proxied requests to agents
+type immortalStreamClient struct {
+	client  *codersdk.Client
+	agentID uuid.UUID
+	logger  slog.Logger
+}
+
+// newImmortalStreamClient creates a new client for immortal streams
+func newImmortalStreamClient(client *codersdk.Client, agentID uuid.UUID, logger slog.Logger) *immortalStreamClient {
+	return &immortalStreamClient{
+		client:  client,
+		agentID: agentID,
+		logger:  logger,
+	}
+}
+
+// createStream creates a new immortal stream
+func (c *immortalStreamClient) createStream(ctx context.Context, port int) (*codersdk.ImmortalStream, error) {
+	stream, err := c.client.WorkspaceAgentCreateImmortalStream(ctx, c.agentID, codersdk.CreateImmortalStreamRequest{
+		TCPPort: port,
+	})
+	if err != nil {
+		return nil, err
+	}
+	return &stream, nil
+}
+
+// listStreams lists all immortal streams
+func (c *immortalStreamClient) listStreams(ctx context.Context) ([]codersdk.ImmortalStream, error) {
+	return c.client.WorkspaceAgentImmortalStreams(ctx, c.agentID)
+}
+
+// deleteStream deletes an immortal stream
+func (c *immortalStreamClient) deleteStream(ctx context.Context, streamID uuid.UUID) error {
+	return c.client.WorkspaceAgentDeleteImmortalStream(ctx, c.agentID, streamID)
+}
+
+// CLI Commands
+
+func (r *RootCmd) immortalStreamCmd() *serpent.Command {
+	client := new(codersdk.Client)
+	cmd := &serpent.Command{
+		Use:   "immortal-stream",
+		Short: "Manage immortal streams in workspaces",
+		Long:  "Immortal streams provide persistent TCP connections to workspace services that automatically reconnect when interrupted.",
+		Middleware: serpent.Chain(
+			r.InitClient(client),
+		),
+		Handler: func(inv *serpent.Invocation) error {
+			return inv.Command.HelpHandler(inv)
+		},
+		Children: []*serpent.Command{
+			r.immortalStreamListCmd(),
+			r.immortalStreamDeleteCmd(),
+		},
+	}
+	return cmd
+}
+
+func (r *RootCmd) immortalStreamListCmd() *serpent.Command {
+	client := new(codersdk.Client)
+	cmd := &serpent.Command{
+		Use:   "list <workspace-name>",
+		Short: "List active immortal streams in a workspace",
+		Middleware: serpent.Chain(
+			serpent.RequireNArgs(1),
+			r.InitClient(client),
+		),
+		Handler: func(inv *serpent.Invocation) error {
+			ctx := inv.Context()
+			workspaceName := inv.Args[0]
+
+			workspace, workspaceAgent, _, err := getWorkspaceAndAgent(ctx, inv, client, false, workspaceName)
+			if err != nil {
+				return err
+			}
+
+			if workspace.LatestBuild.Transition != codersdk.WorkspaceTransitionStart {
+				return xerrors.New("workspace must be running to list immortal streams")
+			}
+
+			// Create immortal stream client
+			// Note: We don't need to dial the agent for management operations
+			// as these go through the server's proxy endpoints
+			streamClient := newImmortalStreamClient(client, workspaceAgent.ID, inv.Logger)
+			streams, err := streamClient.listStreams(ctx)
+			if err != nil {
+				return xerrors.Errorf("list immortal streams: %w", err)
+			}
+
+			if len(streams) == 0 {
+				cliui.Info(inv.Stderr, "No active immortal streams found.")
+				return nil
+			}
+
+			// Display the streams in a table
+			displayImmortalStreams(inv, streams)
+			return nil
+		},
+	}
+	return cmd
+}
+
+func (r *RootCmd) immortalStreamDeleteCmd() *serpent.Command {
+	client := new(codersdk.Client)
+	cmd := &serpent.Command{
+		Use:   "delete <workspace-name> <immortal-stream-name>",
+		Short: "Delete an active immortal stream",
+		Middleware: serpent.Chain(
+			serpent.RequireNArgs(2),
+			r.InitClient(client),
+		),
+		Handler: func(inv *serpent.Invocation) error {
+			ctx := inv.Context()
+			workspaceName := inv.Args[0]
+			streamName := inv.Args[1]
+
+			workspace, workspaceAgent, _, err := getWorkspaceAndAgent(ctx, inv, client, false, workspaceName)
+			if err != nil {
+				return err
+			}
+
+			if workspace.LatestBuild.Transition != codersdk.WorkspaceTransitionStart {
+				return xerrors.New("workspace must be running to delete immortal streams")
+			}
+
+			// Create immortal stream client
+			streamClient := newImmortalStreamClient(client, workspaceAgent.ID, inv.Logger)
+			streams, err := streamClient.listStreams(ctx)
+			if err != nil {
+				return xerrors.Errorf("list immortal streams: %w", err)
+			}
+
+			var targetStream *codersdk.ImmortalStream
+			for _, stream := range streams {
+				if stream.Name == streamName {
+					targetStream = &stream
+					break
+				}
+			}
+
+			if targetStream == nil {
+				return xerrors.Errorf("immortal stream %q not found", streamName)
+			}
+
+			// Delete the stream
+			err = streamClient.deleteStream(ctx, targetStream.ID)
+			if err != nil {
+				return xerrors.Errorf("delete immortal stream: %w", err)
+			}
+
+			cliui.Info(inv.Stderr, fmt.Sprintf("Deleted immortal stream %q (ID: %s)", streamName, targetStream.ID))
+			return nil
+		},
+	}
+	return cmd
+}
+
+func displayImmortalStreams(inv *serpent.Invocation, streams []codersdk.ImmortalStream) {
+	_, _ = fmt.Fprintf(inv.Stderr, "Active Immortal Streams:\n\n")
+	_, _ = fmt.Fprintf(inv.Stderr, "%-20s %-6s %-20s %-20s\n", "NAME", "PORT", "CREATED", "LAST CONNECTED")
+	_, _ = fmt.Fprintf(inv.Stderr, "%-20s %-6s %-20s %-20s\n", "----", "----", "-------", "--------------")
+
+	for _, stream := range streams {
+		createdTime := stream.CreatedAt.Format("2006-01-02 15:04:05")
+		lastConnTime := stream.LastConnectionAt.Format("2006-01-02 15:04:05")
+
+		_, _ = fmt.Fprintf(inv.Stderr, "%-20s %-6d %-20s %-20s\n",
+			stream.Name, stream.TCPPort, createdTime, lastConnTime)
+	}
+	_, _ = fmt.Fprintf(inv.Stderr, "\n")
+}